VeriFactu

io.github.ArceeDevPublished by GitHub account ArceeDevv0.1.0Updated Nov 7, 2026

Audit VERI*FACTU hash chains, build the AEAT tax QR, build and validate Facturae 3.2.2 invoices.

VerifiedStreamable HTTPWeb executableFinanceDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

Audits Spanish VERI*FACTU invoice hash chains, generates AEAT tax QR codes, and builds or validates Facturae 3.2.2 invoices.

What you can do
  • Audit VERI*FACTU record chains from JSON or exported XML: SHA-256 fingerprints, links, duplicates, cancellations, formats
  • Compute the fingerprint of a single record and show the exact hashed string
  • Generate the AEAT tax QR URL and PNG/SVG image with printing rules
  • Build unsigned Facturae 3.2.2 XML from plain invoice data
  • Validate Facturae files: XSD, arithmetic, NIF, DIR3 roles and signature presence
  • Look up compliance deadlines and free helpers such as NIF checks, QR URL checks and credit balance
When to use it
Useful for gestorías, accountants and invoicing-software teams that need to check what a Spanish invoicing system produced, prepare Facturae data, or confirm VERI*FACTU deadlines before filing or sending invoices.
Requirements
A KeyFlint license in KEYFLINT_LICENSE (LIC-...), required for paid tools. Runs as a hosted endpoint with OAuth, or locally via uvx from the verifactu-keyflint-mcp PyPI package; hosted multi-buyer mode uses a Bearer license header. Optional variables configure pricing, public keys, checkout URL and max input size.
Before you install
Paid tools consume credits per call, so usage costs money; a license key is required and must be kept secret. It is not an invoicing system: it stores nothing and sends nothing to the AEAT. Built Facturae XML is unsigned and must be signed with the issuer's certificate before sending to FACe or a B2B platform. Deadline information should be confirmed in the BOE.

Installation

In SourceWeft

  1. Open VeriFactu in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ArceeDev%2Fverifactu-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "verifactu": {
      "type": "http",
      "url": "https://mcp.keyflint.dev/verifactu/mcp"
    }
  }
}

README

verifactu-mcp

On PyPI as verifactu-keyflint-mcp (the name verifactu-mcp belongs to another project).

MCP server for Spanish invoicing compliance, built for AI agents working for gestorías, accountants and invoicing-software teams. Offline and stateless: nothing is stored and nothing is sent to the AEAT.

  • Audit VERI*FACTU chains: recompute the SHA-256 fingerprint (huella) of every record (alta and anulación) exactly as the AEAT specifies, and check that each record links to the previous one. Works on JSON records or on the XML any invoicing program exports (validated against the official SuministroLR.xsd).
  • AEAT tax QR: URL and PNG/SVG image (error correction M) for VERI*FACTU and non-VERI*FACTU systems, production or test portal, with the printing rules.
  • Facturae 3.2.2: build an invoice from plain data (totals, VAT breakdown, IRPF withholding, recargo de equivalencia, DIR3 codes for FACe, IBAN) and validate any Facturae file: official XSD, the arithmetic FACe checks, NIFs, DIR3 roles and signature presence.

The fingerprint code is tested against the three reference vectors published by the AEAT.

Tools

ToolCreditsWhat it does
validate_invoice_chain3Audit a chain of records (JSON, up to 20,000): fingerprints, links, PrimerRegistro, duplicates, cancellations of unknown invoices, timestamps, NIF/date/amount/TipoFactura formats. continues_from audits a chain in pieces.
validate_verifactu_xml3Same audit on exported XML (RegFactuSistemaFacturacion, SOAP envelope or any XML with RegistroAlta/RegistroAnulacion), plus XSD validation.
verifactu_hash1Fingerprint of one record, with the exact string hashed.
generate_verifactu_qr1Tax QR URL + image + printing rules.
build_facturae3Facturae 3.2.2 XML (unsigned) from plain invoice data, XSD-validated.
validate_facturae2XSD + arithmetic + NIF + DIR3 + signature check of a Facturae file.
verifactu_calendarfreeDeadlines in force and what is pending in the BOE, with sources.
check_qr_url, validate_nif, pricing, credits_balancefreeHelpers.

Unreadable or invalid input is never charged; a tool that fails after charging is refunded.

Install

Claude Desktop / Claude Code / Cursor (mcpServers entry):

json
{  "verifactu": {    "command": "uvx",    "args": ["--from", "verifactu-keyflint-mcp", "verifactu-mcp"],    "env": { "KEYFLINT_LICENSE": "LIC-..." }  }}

Hosted (one server, many buyers): verifactu-mcp --http or the Dockerfile; each request carries Authorization: Bearer LIC-....

Environment: KEYFLINT_LICENSE, KEYFLINT_URL, KEYFLINT_PUBLIC_KEYS, KEYFLINT_CHECKOUT_URL, VERIFACTU_PRICES (e.g. validate_invoice_chain=5,build_facturae=4), VERIFACTU_MAX_BYTES (default 10 MB).

Visual cards (MCP Apps)

In Claude, ChatGPT, VS Code and Goose every paid tool and credits_balance renders as an interactive card in the chat: credit balance with a refill bar and a buy button, or a result summary (key figures, issues, table preview and credits charged). It is the ui://verifactu/card.html resource, self-contained with no network access. Other clients keep getting the same JSON as before.

Legal status (checked 2026-11-05)

  • VERI*FACTU (RD 1007/2023, Orden HAC/1177/2024; dates from RD-ley 15/2025): 1 Jan 2027 for corporate income tax payers, 1 Jul 2027 for everyone else. Hacienda announced on 5 Oct 2026 a further delay to October 2028, not yet published in the BOE. Taxpayers on SII and the foral territories are out of scope.
  • Mandatory B2B e-invoicing (RD 238/2026, Orden HAC/1028/2026): 6 Oct 2027 for turnover above 8 M EUR, 6 Oct 2028 for the rest; EN 16931 in UBL, CII, EDIFACT or Facturae.
  • Facturae with XAdES signature is mandatory for invoices to public administrations through FACe.

verifactu_calendar returns this with sources. Always confirm in the BOE.

Scope and limits

  • Not an invoicing system (SIF): it keeps no records, sends nothing to the AEAT and does not replace the producer's declaración responsable. Use it to check what a SIF produced, or to prepare data.
  • build_facturae produces unsigned XML. Sign it (XAdES-EPES) with the issuer's certificate before sending to FACe or a B2B platform. Corrective invoices (InvoiceClass OR) and batches are validated but not built yet.
  • If a stored fingerprint only matches after removing trailing zeros from the amounts, it is reported as a warning (correcta_sin_ceros): the record was generated with amounts written differently from the XML.

Sources

  • AEAT, Detalle de las especificaciones técnicas para generación de la huella o hash de los registros de facturación (reference vectors in tests/test_core.py).
  • AEAT, Características del QR y especificaciones del servicio de cotejo.
  • AEAT web service schemas SuministroLR.xsd / SuministroInformacion.xsd, and Facturaev3_2_2.xsd (facturae.gob.es), bundled in src/verifactu_mcp/schemas/ with the W3C xmldsig schema.

Development

bash
pip install -e '.[test]'pytest -q

Business Source License 1.1. Source available; production use needs a KeyFlint license (or must be non-commercial). Each version becomes Apache 2.0 four years after release. See LICENSE. The bundled XSD files belong to their publishers (AEAT, Ministerio de Hacienda, W3C).

Source: README.md at commit 1831b88

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.1.0LatestNov 7, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.